CVE-2023-23931

CVE-2023-23931 affects the cryptography.io cryptography package, where the Cipher.update_into function incorrectly accepted immutable Python objects, such as bytes, and allowed them to be mutated. This flaw, present since cryptography 1.8, could lead to corrupted output by violating Python's fundamental immutability rules. Rated as Medium severity (CVSS 6.5), it has a low attack complexity and could result in low integrity and availability impacts. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this vulnerability.